ISPs run risk of R 5million RICA fine

Rudolph Muller

Rudolph Muller is the editor at MyBroadband and covers telecoms and broadband news. Rudolph comes from an academic background, but left the University of...

Full Profile

E-mail

The Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA) made headlines recently when the compulsory registration of all SIM cards in use kicked in on 1 June 2009.

The Act requires mobile operators Cell C, MTN and Vodacom, as well as other service providers such as Nashua Mobile, Autopage and Virgin Mobile South Africa, to register on secure databases the identities, physical address and cellular phone numbers of new and existing customers who buy SIM cards.

According to the mobile providers they are ready to enforce this act, and have set up systems to ensure that subscribers can easily register their identities with their respective providers.

The debate surrounding the registering and verifying of millions of prepaid cellphone users has overshadowed the requirement for Internet Service Providers to also abide by the act.

Reinhardt Buys, Senior Manager of Technology Law at Deloitte & Touche, however warns that ISPs who are not fully compliant with the RICA expose themselves to a fine of up to R1-million and even imprisonment.

“The RIC Act 70 of 2002 prescribes customer identification and retention requirements on both ISPs (and other providers of telecommunication services like Telkom) and cell phone providers,” said Buys.

According to section 39 of the RICA a telecommunications service provider must, before entering to a contract with any person:

–Obtain his or her full names, identity number, residential and business or postal address

–Obtain a certified photocopy of his or her identification document on which his or her photo, full names and identity number, whichever is applicable, appear;

–Retain the photocopy obtained

–Verify the photo, full names and identity number, whichever is applicable, of that person with reference to his or her identification document

The same type of information should be obtained, verified and kept for business clients.

Telecommunications Service Providers are also required to keep records of:

–All the information obtained during the registration process

–the telephone number or any other number allocated to the person concerned

–Any other information in respect of the person concerned which the telecommunication service provider concerned may require in order to enable him or her to identify that person.

There are very few ISPs who currently adhere to all of the requirements of the RICA, and this may come to haunt them at a later stage if the state decides to start policing the implementation of the Act.

Buys said that in terms of section 62, the duties related to cell phone companies have been postponed until now (they have the next 18 months during which to become fully compliant).

“However, no such extension applied to ISPs who should by now be fully compliant with section 39 or expose themselves to the rather high R5-million fines and imprisonment,” Buys said.

ISPA not happy with RICA

The Internet Service Providers Association of South Africa (ISPA) was approached on the matter, and the association said that there is no new influence on ISPs and confirmed that ISPs should confirm and verify customers.

ISPA however added that it is not in favour of the Act in its current form.  Problems with complying with the Act are highlighted in more detail in a 2006 ISPA advisory on the RICA, where then ISPA lawyer Mike Silber describes the Act as impractical and costly.

“We are aware that these obligations are impractical, costly and will have a severe negative impact on both ISPs specifically and Internet access in South Africa generally,” the RICA advisory reads.

ISPA added that it has written to the Deputy President and the Minister and Deputy Minister of Communications in this regard as well as actively lobbying for a change to Section 39.  To date nothing has changed though.

The RICA has also been criticized for “the fact that the definition of ISP in RICA is badly broken”. 

According to the Act an ISP is: “…any person who provides access to, or any other service related to, the Internet to another person, whether or not such access or service is provided under and in accordance with a telecommunication service licence issued to the first-mentioned person under Chapter V of the Telecommunications Act”.

According to one industry expert this is an incredibly broad definition, and could easily include a company providing Internet access to its staff, a school providing Internet access to students or web hosting company.

ISPs give their view

While some ISPs are resistant towards implementing the systems required to abide by the Act, others appear to be happy to adhere to it without a fight.

Telkom says that RICA will influence the way it conducts its business, presently and in the future.  “As Telkom intends to enter the mobile space, Section 40 of RICA will also require Telkom to record, store and verify certain customer information before any SIM card is activated,” the fixed line provider said. 

Telkom is further in full support of RICA, saying that the objectives of the Act are important and must be supported.  “As a good corporate citizen, Telkom always endeavours to abide by the legal and regulatory landscape within which the Company is required to operate.”

iBurst said that it operates primarily on a postpaid model and therefore has always required customers to furnish it with appropriate documentation. “RICA does outline additional requirements that iBurst is working tirelessly to comply with.”

MWEB CEO Rudi Jansen says that the Act will have an effect on them, but that they are very supportive of it. “MWEB will be in a position to comply with the dates specified,” said Jansen.

Internet Solutions was not as forthcoming regarding RICA, and merely said that it would like to reserve comment on this matter for the time being.

Neotel said that RICA does not directly affect them at the moment as they don’t have SIM cards. “This is a mobile issue,” said Neotel.

What is clear is that the RICA, which has been in force for a few years already, does not only pose a challenge for the mobile operators but also for the country’s Internet Service Providers. 

The impractical and costly nature of implementing all the requirements of the Act may well mean that most ISPs continue to conduct their business without being fully RICA compliant, in the hope that they will not be asked to furnish the required information.

RICA and ISPs – discussion and comments